Subscriber-to-Administrator escalation via unchecked role assignment

Privilege escalation in Pronamic Pay 10.1.0 and earlier allows remote authenticated users to promote their WordPress accounts to Administrator. The maybe_update_user_role function passes an attacker-controlled Gravity Forms role field directly to WP_User::set_role without an allowlist, capability comparison, or permission check. A Subscriber account is sufficient, but an administrator must first enable Update User Role on a Pronamic Pay payment feed and map it to a form field.